CVE-2026-108947 | yoshitomo-matsubara torchdistill up to 1.1.5 main_util.py load_ckpt src_ckpt deserialization (Issue 550)

October 11, 2026 Yanac

A vulnerability was found in yoshitomo-matsubara torchdistill up to 1.1.5 and classified as problematic. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization.

This vulnerability is registered as CVE-2026-108947. The attack needs to be launched locally. Furthermore, an exploit is available.

The project maintainer explains: “This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate.”VulDB Recent EntriesRead More